Cookie consent

Cookie consent platforms, formally Consent Management Platforms (CMPs), are the technical and legal infrastructure that websites use to collect, record, and document user consent for cookies and similar tracking technologies. They present the cookie banner, capture the user's choice at a granular purpose level, maintain timestamped audit logs, and communicate the consent signal to downstream marketing, analytics, and personalisation scripts. Without a functioning CMP, placing any non-essential cookie on an EU visitor's device is a violation of the ePrivacy Directive and a potential GDPR breach.

For EU buyers, the consent log is itself personal data: it records a user's choices, linked to a browsing session, at a specific time. Where that log is stored and who controls the infrastructure matters for the same reasons it does for any other personal-data processor. A US-owned CMP operating on EU servers is still potentially reachable by the CLOUD Act if the parent company is US-incorporated. EU-owned operators such as ConsentManager (Germany, EU-owned, EU-hosted) and Didomi (France, EU-owned, EU-hosted) are not subject to that direct exposure. Cookiebot (Denmark) and Usercentrics (Germany) are both EU-headquartered but carry US funding that affects their ownership signal.

Each listing carries country of incorporation, ownership signal, and factual compliance signals (EU/adequacy hosting, EU ownership, CLOUD Act exposure, public DPA, sub-processor disclosure), sourced from published DPAs and corporate filings rather than paid placement. Procurement rules that require strictly EU-owned processors point to the ownership filter; the scale filter is the other one worth knowing, since it separates single-site tools from enterprise platforms with multi-domain management, banner A/B testing, and jurisdiction-specific consent flows.